Solved

Downloads mistakenly denied

Posted on 2012-04-03
1
531 Views
Last Modified: 2012-04-04
Dear all,

We'rve been using  Forefront TMG for a few months in single NIC configuration.  for most websites, we deny  download of certain types of content. But we would like to allow everything for  a limited numbers of website, like Intranet websites. No restriction is applied except for the destination.. It's open to all users, all content types, all protocolsThis rules is called:

Anonymous access

So we created a rule allowing everything for those  Domain and URLs sets for which we want to allow  users to download. the rules comes is at  the top of the "Web Access policy Group" list.


And down the list you can find the rule that denies download for every other websites except the Domain and URLs sets for which we allow downloads specified "Anonymous Access" rule above. This denying rules is called

HTTP Downloads Forbidden

Rule settings:
Users: Domain Users.Exceptions: Admins and Helpdesk
From: Internal and local host
To:Internal and local host: Exceptions: Domain, Network and URLs sets specified in the "Anonymous Access rule"


Administrators and Helpdesk have no problem. But  domain users when trying to download from URL's contained in  the "Anonymous access" rule, they still get blocked by the "HTTP Downloads Forbidden" rule.

Any idea?

Thanks everyone!

Mart
0
Comment
Question by:MartCar
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 3

Accepted Solution

by:
rafter81 earned 500 total points
ID: 37803659
The domains and/or urls are not being actioned correctly.  I've found in the past that this can be for various reasons.  It can be that the domain or url the site initially goes to then goes to another site.  It can simply be that its the IP address that is recognised instead of the url or domain.  I've found that domains and url rules are unreliable.

Have you tried looking up a particular site you want to give access to, find it's IP address and give access that way in the "anonymous rule"..  Adding it as a computer or computer set, or subnet if relevent.

Its worth trying out IP addresses - it will confirm if the 1st rule is actually working correctly as its not using this rule it is going through to the deny rule which domain users are denied.  That would be why its working ok for your admins as they are exceptions..
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

ISA Server detected routes through the network adapter LAN that do not correlate with the network to which this network adapter belongs What does this mean and how can one go about correcting it? In simple terms, this error message indicates t…
In all versions of ISA Server and the current version of FTMG, the default https protocol uses TCP port 443 and 563 only. This cannot be changed within the ISA or FTMG GUI and must be completed from a Windows cmd prompt on the ISA Server itself. …
In this video, viewers will be given step by step instructions on adjusting mouse, pointer and cursor visibility in Microsoft Windows 10. The video seeks to educate those who are struggling with the new Windows 10 Graphical User Interface. Change Cu…
In this brief tutorial Pawel from AdRem Software explains how you can quickly find out which services are running on your network, or what are the IP addresses of servers responsible for each service. Software used is freeware NetCrunch Tools (https…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question